systex | 388f1b7791e27d6e4c2f0ff4549f5f436ae748860c706702f74217018a48360e

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260710-wevbxagv7s
SHA256 388f1b7791e27d6e4c2f0ff4549f5f436ae748860c706702f74217018a48360e
MD5 6b4c00c7eeb7c390587697573ab5d2a4
SHA1 dd075043781ac1b8a1bed4e8dfa630bdc545dae8
SHA512 645f5d3d02e6c9a781c6bdb4cd66b4e196d10239cbb98d1a1bb8841c7426107584528c96cd0f315e8c622f5c927f26d0af7d10e4e2ebb1b589ab5c85e548a5bc
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1F7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2976	wrojgbywqomgebwu.exe
2640	wrojgbywqomgebwu.sys
2092	CreateProcess.exe
5032	dbwtomgeyw.exe
5216	CreateProcess.exe
1860	CreateProcess.exe
3120	i_dbwtomgeyw.exe
2416	omgeywqoig.sys
3972	CreateProcess.exe
4140	yvqoigaytq.exe
5212	CreateProcess.exe
2764	CreateProcess.exe
2524	i_yvqoigaytq.exe
1268	dbvtqljdbv.sys
4108	CreateProcess.exe
5328	sqoigavtnl.exe
5324	CreateProcess.exe
4684	CreateProcess.exe
2992	i_sqoigavtnl.exe
1296	faxvqnlfdy.sys
3108	CreateProcess.exe
3560	xvqnigaysq.exe
5836	CreateProcess.exe
4544	CreateProcess.exe
1900	i_xvqnigaysq.exe
2588	snkfcxusqk.sys
4848	CreateProcess.exe
5572	pkhfdxvpnh.exe
3436	CreateProcess.exe
3888	CreateProcess.exe
2752	i_pkhfdxvpnh.exe
2628	kifaxspkfc.sys
3564	CreateProcess.exe
1468	cxrpkhfzxr.exe
1256	CreateProcess.exe
5344	CreateProcess.exe
4868	i_cxrpkhfzxr.exe
1296	zusmkecwup.sys
5576	CreateProcess.exe
1004	usmkecwupm.exe
3672	CreateProcess.exe
5208	CreateProcess.exe
4120	i_usmkecwupm.exe
4260	zurpmhezxr.sys
5008	CreateProcess.exe
2336	cwuomjecwu.exe
1176	CreateProcess.exe
4404	CreateProcess.exe
4184	i_cwuomjecwu.exe
1516	bztrljebzt.sys
1588	CreateProcess.exe
1460	ztrljebztr.exe
1268	CreateProcess.exe
4712	CreateProcess.exe
544	i_ztrljebztr.exe
4868	zwqomgeywq.sys
5768	CreateProcess.exe
5784	qoigbytrlj.exe
3816	CreateProcess.exe
5448	CreateProcess.exe
5228	i_qoigbytrlj.exe
2580	bvtolgeywq.sys
4472	CreateProcess.exe
1084	vtolgeywqo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_314208740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_314208740\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_314208740\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1815993665\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1665925990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1658512611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1815993665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1665925990\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_314208740\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbywqomgebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbzl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxrpkhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxrpkhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjebzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjebzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbzl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
792	ipconfig.exe
4728	ipconfig.exe
2640	ipconfig.exe
1132	ipconfig.exe
5552	ipconfig.exe
4356	ipconfig.exe
5144	ipconfig.exe
4720	ipconfig.exe
4572	ipconfig.exe
3120	ipconfig.exe
2156	ipconfig.exe
708	ipconfig.exe
5068	ipconfig.exe
3572	ipconfig.exe
1324	ipconfig.exe
6016	ipconfig.exe
2832	ipconfig.exe
1384	ipconfig.exe
2460	ipconfig.exe
1448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281794451906268"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{75A4A7CC-6CBC-4B23-BB70-D88A1F9B8578}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe
2976	wrojgbywqomgebwu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	i_dbwtomgeyw.exe
Token: SeDebugPrivilege	2524	i_yvqoigaytq.exe
Token: SeDebugPrivilege	2992	i_sqoigavtnl.exe
Token: SeDebugPrivilege	1900	i_xvqnigaysq.exe
Token: SeDebugPrivilege	2752	i_pkhfdxvpnh.exe
Token: SeDebugPrivilege	4868	i_cxrpkhfzxr.exe
Token: SeDebugPrivilege	4120	i_usmkecwupm.exe
Token: SeDebugPrivilege	4184	i_cwuomjecwu.exe
Token: SeDebugPrivilege	544	i_ztrljebztr.exe
Token: SeDebugPrivilege	5228	i_qoigbytrlj.exe
Token: SeDebugPrivilege	5564	i_vtolgeywqo.exe
Token: SeDebugPrivilege	4168	i_sqkigdyvqo.exe
Token: SeDebugPrivilege	5780	i_nkfdxusnkf.exe
Token: SeDebugPrivilege	5696	i_nhfcxuspnh.exe
Token: SeDebugPrivilege	3496	i_uspkhczurp.exe
Token: SeDebugPrivilege	2904	i_rljebwuolj.exe
Token: SeDebugPrivilege	1500	i_bztrljdbzl.exe
Token: SeDebugPrivilege	2052	i_bvtoljdbyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2976	1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1444 wrote to memory of 3316	1444	2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3316 wrote to memory of 3024	3316	iexplore.exe	91
PID 3024 wrote to memory of 2932	3024	msedge.exe	92
PID 3024 wrote to memory of 3160	3024	msedge.exe	93
PID 3024 wrote to memory of 4820	3024	msedge.exe	94
PID 3024 wrote to memory of 3160	3024	msedge.exe	93
PID 3024 wrote to memory of 3160	3024	msedge.exe	93
PID 3024 wrote to memory of 2308	3024	msedge.exe	95
PID 3024 wrote to memory of 2308	3024	msedge.exe	95
PID 3024 wrote to memory of 3792	3024	msedge.exe	97
PID 3024 wrote to memory of 5900	3024	msedge.exe	98
PID 3024 wrote to memory of 3792	3024	msedge.exe	97
PID 3024 wrote to memory of 3792	3024	msedge.exe	97
PID 3024 wrote to memory of 5900	3024	msedge.exe	98
PID 3024 wrote to memory of 5900	3024	msedge.exe	98
PID 3024 wrote to memory of 1400	3024	msedge.exe	99
PID 3024 wrote to memory of 1460	3024	msedge.exe	100
PID 3024 wrote to memory of 1400	3024	msedge.exe	99
PID 3024 wrote to memory of 1400	3024	msedge.exe	99
PID 3024 wrote to memory of 1460	3024	msedge.exe	100
PID 3024 wrote to memory of 1460	3024	msedge.exe	100
PID 3024 wrote to memory of 4832	3024	msedge.exe	121
PID 3024 wrote to memory of 4832	3024	msedge.exe	121
PID 2976 wrote to memory of 2092	2976	wrojgbywqomgebwu.exe	105
PID 5032 wrote to memory of 5216	5032	dbwtomgeyw.exe	108
PID 3024 wrote to memory of 5628	3024	msedge.exe	111
PID 3024 wrote to memory of 2388	3024	msedge.exe	112
PID 3024 wrote to memory of 5628	3024	msedge.exe	111
PID 3024 wrote to memory of 2388	3024	msedge.exe	112
PID 3024 wrote to memory of 4904	3024	msedge.exe	114
PID 3024 wrote to memory of 2188	3024	msedge.exe	115
PID 3024 wrote to memory of 2188	3024	msedge.exe	115
PID 3024 wrote to memory of 2836	3024	msedge.exe	118
PID 3024 wrote to memory of 2836	3024	msedge.exe	118
PID 2976 wrote to memory of 1860	2976	wrojgbywqomgebwu.exe	119
PID 2976 wrote to memory of 3972	2976	wrojgbywqomgebwu.exe	123
PID 4140 wrote to memory of 5212	4140	yvqoigaytq.exe	125
PID 2976 wrote to memory of 2764	2976	wrojgbywqomgebwu.exe	128
PID 2976 wrote to memory of 4108	2976	wrojgbywqomgebwu.exe	132
PID 5328 wrote to memory of 5324	5328	sqoigavtnl.exe	134
PID 2976 wrote to memory of 4684	2976	wrojgbywqomgebwu.exe	137
PID 2976 wrote to memory of 3108	2976	wrojgbywqomgebwu.exe	142
PID 3560 wrote to memory of 5836	3560	xvqnigaysq.exe	144
PID 2976 wrote to memory of 4544	2976	wrojgbywqomgebwu.exe	147
PID 3024 wrote to memory of 1952	3024	msedge.exe	149
PID 3024 wrote to memory of 4832	3024	msedge.exe	150
PID 3024 wrote to memory of 1384	3024	msedge.exe	151
PID 2976 wrote to memory of 4848	2976	wrojgbywqomgebwu.exe	154
PID 5572 wrote to memory of 3436	5572	pkhfdxvpnh.exe	156
PID 2976 wrote to memory of 3888	2976	wrojgbywqomgebwu.exe	159
PID 2976 wrote to memory of 3564	2976	wrojgbywqomgebwu.exe	163
PID 1468 wrote to memory of 1256	1468	cxrpkhfzxr.exe	165
PID 2976 wrote to memory of 5344	2976	wrojgbywqomgebwu.exe	168
PID 2976 wrote to memory of 5576	2976	wrojgbywqomgebwu.exe	172
PID 1004 wrote to memory of 3672	1004	usmkecwupm.exe	174
PID 2976 wrote to memory of 5208	2976	wrojgbywqomgebwu.exe	177
PID 2976 wrote to memory of 5008	2976	wrojgbywqomgebwu.exe	181
PID 2336 wrote to memory of 1176	2336	cwuomjecwu.exe	183
PID 2976 wrote to memory of 4404	2976	wrojgbywqomgebwu.exe	186
PID 3024 wrote to memory of 1124	3024	msedge.exe	188
PID 3024 wrote to memory of 1124	3024	msedge.exe	188
PID 2976 wrote to memory of 1588	2976	wrojgbywqomgebwu.exe	194
PID 1460 wrote to memory of 1268	1460	ztrljebztr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_6b4c00c7eeb7c390587697573ab5d2a4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Temp\wrojgbywqomgebwu.exe
  C:\Temp\wrojgbywqomgebwu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2092
  - - C:\Temp\dbwtomgeyw.exe
      C:\Temp\dbwtomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\i_dbwtomgeyw.exe
      C:\Temp\i_dbwtomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3972
  - - C:\Temp\yvqoigaytq.exe
      C:\Temp\yvqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\i_yvqoigaytq.exe
      C:\Temp\i_yvqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqoigavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\sqoigavtnl.exe
      C:\Temp\sqoigavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqoigavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4684
  - - C:\Temp\i_sqoigavtnl.exe
      C:\Temp\i_sqoigavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3108
  - - C:\Temp\xvqnigaysq.exe
      C:\Temp\xvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\i_xvqnigaysq.exe
      C:\Temp\i_xvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4848
  - - C:\Temp\pkhfdxvpnh.exe
      C:\Temp\pkhfdxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Temp\i_pkhfdxvpnh.exe
      C:\Temp\i_pkhfdxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxrpkhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3564
  - - C:\Temp\cxrpkhfzxr.exe
      C:\Temp\cxrpkhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxrpkhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\i_cxrpkhfzxr.exe
      C:\Temp\i_cxrpkhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5576
  - - C:\Temp\usmkecwupm.exe
      C:\Temp\usmkecwupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5208
  - - C:\Temp\i_usmkecwupm.exe
      C:\Temp\i_usmkecwupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5008
  - - C:\Temp\cwuomjecwu.exe
      C:\Temp\cwuomjecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\i_cwuomjecwu.exe
      C:\Temp\i_cwuomjecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1588
  - - C:\Temp\ztrljebztr.exe
      C:\Temp\ztrljebztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\i_ztrljebztr.exe
      C:\Temp\i_ztrljebztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\qoigbytrlj.exe
      C:\Temp\qoigbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Temp\i_qoigbytrlj.exe
      C:\Temp\i_qoigbytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\vtolgeywqo.exe
      C:\Temp\vtolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    PID:416
  - - C:\Temp\i_vtolgeywqo.exe
      C:\Temp\i_vtolgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkigdyvqo.exe ups_run
    3⤵
    PID:1396
  - - C:\Temp\sqkigdyvqo.exe
      C:\Temp\sqkigdyvqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkigdyvqo.exe ups_ins
    3⤵
    PID:1368
  - - C:\Temp\i_sqkigdyvqo.exe
      C:\Temp\i_sqkigdyvqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxusnkf.exe ups_run
    3⤵
    PID:2740
  - - C:\Temp\nkfdxusnkf.exe
      C:\Temp\nkfdxusnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxusnkf.exe ups_ins
    3⤵
    PID:2900
  - - C:\Temp\i_nkfdxusnkf.exe
      C:\Temp\i_nkfdxusnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcxuspnh.exe ups_run
    3⤵
    PID:5640
  - - C:\Temp\nhfcxuspnh.exe
      C:\Temp\nhfcxuspnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcxuspnh.exe ups_ins
    3⤵
    PID:1840
  - - C:\Temp\i_nhfcxuspnh.exe
      C:\Temp\i_nhfcxuspnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhczurp.exe ups_run
    3⤵
    PID:1028
  - - C:\Temp\uspkhczurp.exe
      C:\Temp\uspkhczurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhczurp.exe ups_ins
    3⤵
    PID:3684
  - - C:\Temp\i_uspkhczurp.exe
      C:\Temp\i_uspkhczurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjebzuom.exe ups_run
    3⤵
    PID:3832
  - - C:\Temp\urmjebzuom.exe
      C:\Temp\urmjebzuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjebzuom.exe ups_ins
    3⤵
    PID:456
  - - C:\Temp\i_urmjebzuom.exe
      C:\Temp\i_urmjebzuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebwuolj.exe ups_run
    3⤵
    PID:4512
  - - C:\Temp\rljebwuolj.exe
      C:\Temp\rljebwuolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebwuolj.exe ups_ins
    3⤵
    PID:3752
  - - C:\Temp\i_rljebwuolj.exe
      C:\Temp\i_rljebwuolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbzl.exe ups_run
    3⤵
    PID:1640
  - - C:\Temp\bztrljdbzl.exe
      C:\Temp\bztrljdbzl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbzl.exe ups_ins
    3⤵
    PID:5024
  - - C:\Temp\i_bztrljdbzl.exe
      C:\Temp\i_bztrljdbzl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtoljdbyw.exe ups_run
    3⤵
    PID:2300
  - - C:\Temp\bvtoljdbyw.exe
      C:\Temp\bvtoljdbyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtoljdbyw.exe ups_ins
    3⤵
    PID:2752
  - - C:\Temp\i_bvtoljdbyw.exe
      C:\Temp\i_bvtoljdbyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idaysqoiga.exe ups_run
    3⤵
    PID:2408
  - - C:\Temp\idaysqoiga.exe
      C:\Temp\idaysqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffee37ac188,0x7ffee37ac194,0x7ffee37ac1a0
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8397317013663521554,15930225007262060651,262144 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15363840087941843316,12408108942950371791,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:11
      4⤵
      System Time Discovery
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8915783085719255347,11735262523943121046,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,5051392060339327361,11669555159857147403,2097152 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,5517932845972334760,3573999722643682497,2097152 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,13208272046817969854,4887059233069657062,2097152 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,7212115871166476787,1394366603511651795,2097152 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:9
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,8400384756551899687,12069497232470032143,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,12598909405859188746,2438932035663547889,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8945170178836054825,5522399037130985995,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4383159799172449776,7756555582026608807,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4383159799172449776,7756555582026608807,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,11413008987604775731,4664097202861550621,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,6213579619893387144,4615036512759692447,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17489028727685735841,9875747446722100970,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15544166983932442621,10655872679996177660,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,14191872396130008219,16639914910346196831,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,9266998384788017151,7893903172321290354,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,907886851144464282,639008415806008345,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,5354530355822683603,14981313028600446224,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,7124341192548356163,8872938024265176718,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5156,i,9778333761118207858,14320281074658255500,262144 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:10
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,3722174212774921233,6778354034150559362,524288 --field-trial-handle=2360,i,16123051386714032762,3149167536597564336,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:14
      4⤵
      PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3544

C:\Temp\wrojgbywqomgebwu.sys
C:\Temp\wrojgbywqomgebwu.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5380

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4832

C:\Temp\omgeywqoig.sys
C:\Temp\omgeywqoig.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\dbvtqljdbv.sys
C:\Temp\dbvtqljdbv.sys
1⤵
- Executes dropped EXE
PID:1268

C:\Temp\faxvqnlfdy.sys
C:\Temp\faxvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:1296

C:\Temp\snkfcxusqk.sys
C:\Temp\snkfcxusqk.sys
1⤵
- Executes dropped EXE
PID:2588

C:\Temp\kifaxspkfc.sys
C:\Temp\kifaxspkfc.sys
1⤵
- Executes dropped EXE
PID:2628

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:1296

C:\Temp\zurpmhezxr.sys
C:\Temp\zurpmhezxr.sys
1⤵
- Executes dropped EXE
PID:4260

C:\Temp\bztrljebzt.sys
C:\Temp\bztrljebzt.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\zwqomgeywq.sys
C:\Temp\zwqomgeywq.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\tnlidayvtn.sys
C:\Temp\tnlidayvtn.sys
1⤵
PID:1536

C:\Temp\spnifdxvpn.sys
C:\Temp\spnifdxvpn.sys
1⤵
PID:1608

C:\Temp\vsnkfcxusn.sys
C:\Temp\vsnkfcxusn.sys
1⤵
PID:792

C:\Temp\usmkhczxvp.sys
C:\Temp\usmkhczxvp.sys
1⤵
PID:4312

C:\Temp\zurmkecwur.sys
C:\Temp\zurmkecwur.sys
1⤵
PID:928

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
PID:1132

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
PID:1960

C:\Temp\gayvtqligd.sys
C:\Temp\gayvtqligd.sys
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxrpkhfzxr.exe

Path C:\Temp\cxrpkhfzxr.exe
Size 361KB
SHA256 0f8f8b3ffd299331a6c70f357ce55d09add1907a8d82b12816fc089a18fcc519
MD5 2486bf562c2ad73fb149378823d9cce8
SHA1 360e66dba42e8c2db646b814c4bd77733ed07568
SHA512 f2f66a9a71bf8982a6a1c2beeee17f883991bf0b6cef3038eddb3a2c4fed13392487ec169a09c41b6bd21ca9d135700875c2147ed775e844a5a18e9b06edb36c
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T14C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqljdbv.sys

Path C:\Temp\dbvtqljdbv.sys
Size 293KB
SHA256 52c677155110461549df94f9e21f27625169a72e3c0ab33d01941a4d9bfbc77a
MD5 3f934f5d300246d2d0dcb7d19d951daf
SHA1 ed16cdba9f4336914261e0e0122f6f5364962ab4
SHA512 9aca902a7ed8a02a73cc37900dd38476908512ec2bab7d30f42e5252ad910a48b3099290d275e232c7d1687afbf7cf50ecd918feff362779cc0a8f042ff2e74a
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeyw.exe

Path C:\Temp\dbwtomgeyw.exe
Size 361KB
SHA256 52af8cb04e616ed7feed9d39e9fc6e1b061d29f2c02c2139ab8bd902f4a5440b
MD5 ca9a0d90f9a8f9538cec20232e0ad8e5
SHA1 d1b5d377a21bdd5cefbf94720f2c09cc1b9ad388
SHA512 3e97b45fb07e11d3d5d42e821d489eac52e926877d809a4a00f013db94f358558a47a2f871f3af8ad40cdd5c429e1fa1b2697d5ef2badd587e73fa13e52537a1
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1D0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvqnlfdy.sys

Path C:\Temp\faxvqnlfdy.sys
Size 293KB
SHA256 f1eabfcb18f185e4d4a4b8e718f5e642b4f87260584e7b57854b9ec3f7598d7d
MD5 f0149a413280bdf006a48f307e14d780
SHA1 99ced0e382eb643acf57886eff1ad215aa6d0633
SHA512 a19563a50fb3eb8b2681a20f4c2ed95599a95a55ccce73285f6b38d0e232270a71a46429d32fcb7739f10177d1d3127acc19bca071e0ac11e0137acf77671c2f
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtomgeyw.exe

Path C:\Temp\i_dbwtomgeyw.exe
Size 361KB
SHA256 e2d8abf11c99a0dc542e302d713d70f608e825b708696bf00f641cec35b5dee1
MD5 a97becf3a56dd4511e8ad1d09f2d64f1
SHA1 8cbaae88a0d7c6233fbb3d00966d35c61b6f80e8
SHA512 a37d6f4f031469f80c7ed5fb654a38cc756aca01c997039ec3290e6a153d7f5dbc8a1e14a10b906db5ef1c16af686223eb128d5ac3a710acafe81a061cde2265
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T12D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhfdxvpnh.exe

Path C:\Temp\i_pkhfdxvpnh.exe
Size 361KB
SHA256 5e961a79b80bb55cda1ceef1f0fe2acd9ce72d0573db88c279646eac492be33e
MD5 53501f3359ee43bc57da51e985376508
SHA1 c0cd7bbbac9f181eb1cce90d21cf11b6ff8a1914
SHA512 e8f1750fad626bb00d7de1cb3f6a463140686be7c45d4727a084df041e16da5396b3ffe46943c1f960dd52f1506017aa604946c095d8d554f5a9e5acfb4d8105
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1E4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqoigavtnl.exe

Path C:\Temp\i_sqoigavtnl.exe
Size 361KB
SHA256 238b80c94718a54e59d068b0dfb2612959e4b23c79308839b801a1fd9c3f6448
MD5 c80d583a198d774ded0595281c5c35d5
SHA1 d0afc868da45896671b9deb0177d045d594e1dfe
SHA512 04fab2276610c7fd8c91d09ca2d4492d278e91f2bd155fc2ab5159b2c6f8f5b3570717532a16b6d6c7d894ff4be2f0f49a2248f3a51130ca8f17987445a8752f
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1A4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnigaysq.exe

Path C:\Temp\i_xvqnigaysq.exe
Size 361KB
SHA256 d467c4ed567da95d904c5a0ca1f7fbbcd413af1ac7e44517eb14813c7bcfa9b9
MD5 75600eb5d72d1e3102b89202957b1788
SHA1 a397315bfaf652c5731fe201f517021e0ac004a2
SHA512 2abc0c35a745aa0315e175d3f111770d01a31489e79dba9ca7c4413120c4ad2186f18c11727882ed5629aadbfcd0c9ac6847b3c14f5086ce27253c09e9951dbe
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T19B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaytq.exe

Path C:\Temp\i_yvqoigaytq.exe
Size 361KB
SHA256 0354d9bca6941d4f2569a75f1e99d4417574d6b261d2fb52d45c183a65e361ce
MD5 8ad1c49bc3dd6693519da2c83659a0d3
SHA1 69e4e07e9e0760064dcc0948e5ab19caba489f36
SHA512 9bb7814798a3a4ae1c6f8280be3f42622615937e898f6d8a27dcd26692c50c41143c5bcbdb2dbe5cc2d5109668f7f4f44e37953b474444e4df348fb0a6094249
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T134747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxspkfc.sys

Path C:\Temp\kifaxspkfc.sys
Size 293KB
SHA256 8a7ab58964776ed79260950277b1fbe9d10f3e193a3f2ce05a7923a3eca7222a
MD5 d20a0fcbbeeaaf3b7393f40af4265b10
SHA1 410e8b3d892c3ae93d59e228d2c48c37fa8f4c36
SHA512 909adb7b14762ac19e3f271efd16813357d64296879b7097057e8288391c82e170c4a12bd0892384c91d5db3434efef6cc39b4ce7c9ece5df005dcce68f74fd4
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqoig.sys

Path C:\Temp\omgeywqoig.sys
Size 293KB
SHA256 d04a810bff2b4758642de042a99ab2953bfcbb418fb4f4731e9fafdab8c22a76
MD5 5cbef7bc6398d5750d073893215d8797
SHA1 daaef15473e3b4ec28bd38165e8b62250a7c1e39
SHA512 785d709b7f5178d9e8c866e5cc17c5867a42882b0e6885f6290eea1307fcfdff3932aaf2459a81a4c21fb29bcb6b14b124c99e798091ec3a3c5554c7968d8f0f
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhfdxvpnh.exe

Path C:\Temp\pkhfdxvpnh.exe
Size 361KB
SHA256 ccb07a50f12547e223423eeeba3005b85d7d883ba4e7b9d5b6c573b6983ad584
MD5 27a37a6c34216c8033c1b48cb9e14d86
SHA1 fecdf992e85d4b8a03d8c887bad5a77f36608515
SHA512 945ee80a64d00dfe893e6d2533b7498e783349b303b80e3ed4214677706ec9bcb43539c85f8ed26fa0e2b931ef5b3258a37e7f25d810b0412e258f2f183d6ae8
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T16F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxusqk.sys

Path C:\Temp\snkfcxusqk.sys
Size 293KB
SHA256 0fbe6bb0c07c8bce6a1641bda37e8705bbc9d2b93758a19deb70e564ad561466
MD5 31c8cf450ad6f697b442c0dcf0285490
SHA1 8b12d9cdf4a308d86716484f3addff37e2c36da9
SHA512 6abc8a1aaf7cc68499643055808d77d83fd7c4c08c31f5ce2183d6c85662155cbe508fd903483bb21b9bc15634c979fca2ca0ca605f06e3c2fbb823455c23114
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T13D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqoigavtnl.exe

Path C:\Temp\sqoigavtnl.exe
Size 361KB
SHA256 c41110d1b2000b52b7af76ab1a7f44dba48e6c00215aaa74014cbe4b3e655bb4
MD5 179212ef0e690909a7341559d8e78784
SHA1 c7c52357bca6574828eabc21f35891fb3e3092d0
SHA512 af78a224dec01462a6ca89b84ecca24fe2bc85911dc108bad2d67f959b3aa1bb40cd1242efe2818e1d447b579542ad767ef55e510cf73f997c40426ecbe6f532
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T17A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbywqomgebwu.exe

Path C:\Temp\wrojgbywqomgebwu.exe
Size 361KB
SHA256 9b3b9b2bbaa4f8449bfe7e83b97f2a9095929d921465ee2be81ef7cf920ff2e7
MD5 7b622db276ec5043e23457954e7c90a8
SHA1 d556e1eb752882bc62be18d317293d789d46167c
SHA512 65f3f8331abd6701a896610f2a6d511d66e30c52cc09709d86124c4860b5459d801ead4566360137f6968e5cf2ceda5610064e6d0334a5f30648c9321c44c63a
SSDEEP 6144:sflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:sflfAsiVGjSGecvX
TLSH
T1E6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbywqomgebwu.sys

Path C:\Temp\wrojgbywqomgebwu.sys
Size 293KB
SHA256 be4f6faea8d31c1d4a34d94ef11de8d934093d17149051406d84377e64891567
MD5 6934d4ae27b7dab99a50a9f45dcf3fe7
SHA1 33289853f1b48a34c6f34b5b183c2c99d3bceb83
SHA512 1bc0d3da200f01151be39649337ab989d2bae691a972457bd1a4f8d798bc33daaafc007c06932faf1daa9184da97f322513c283e2c24c66f90f0b56f714ffffa
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnigaysq.exe

Path C:\Temp\xvqnigaysq.exe
Size 361KB
SHA256 92c8fa2344cf08c8f56847114be98c0826b321b424d2a221c8acf91649b98679
MD5 1b5c2b052c46b2df2221a813e7de1875
SHA1 f8bcb1aedc4270c37dd27b68f2ad47aec32bca32
SHA512 dfd06df23037cd19775b6a2399dcf414d62cba0fa4c2de4bd8f1d79b872799ee311db1235b6b44d2ace9aaa1e9be47e0a4b4279a6afd70e93a5fa5ddcdc09f5b
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaytq.exe

Path C:\Temp\yvqoigaytq.exe
Size 361KB
SHA256 15347deb838b0a22a33ecb08c116e8c81439a90c42f1e912cb85bd8e9debdeda
MD5 aed7afcfff1df6830f2bde61513de95a
SHA1 0625f8078c3ada7c4b71c8d4aeb744af47cf854b
SHA512 9e426c46d5b3b96f1663aeda24d741c24503a95b342e652a82387a80e98231b1cf2847feea572ce303ab5c253e41803d4199cba73121729b347b763f658c984d
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T17B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 32818dcaa9404bba2424a47a886b99276cc7f7cb4333df2d8c0d1f72c36007e8
MD5 da88b8c36fb1693e719e61222fc66b61
SHA1 d7c1c5e147fc119b36af205104733dd81c841a43
SHA512 47216c464b30d272ee82466042c0bf2cba185dfdd36f543471b80cba8cf6777e19614b415ac96f86218afbfd0147df2237a37670bf2ecbfb2cc2946cfe98b7c9
TLSH
T176512DD8437D09D2C7375ABE42E14B8A32F5892555732EA213C02EBC1847F35E0C072B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 54c64b7093bbc7c010afb4b482fb13d341392ced73884f4a9ed8f441bb180743
MD5 4be1e28cc8bb8c9829d0752d43b84cdc
SHA1 4961c1600e5eb3ad4b354f6ce8d00668c7d8818b
SHA512 b991febb644919f191634738e3fe684e2d1ca937d13bdaa3aeb11d8f54b18f372f00012860923d1d84d5de11c04a6396de5beb12a046200e56ffd3e43b0640b6
TLSH
T1FA41BBF3C3E8866E890156F0AA186E1BDE1D0915832C3D5AC9E4AF5B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4250dcd94148cd11b0238e8bace6e434c6a7c01322ac232289a2fd40a9b7f98a
MD5 bb93c2c1f455cc56fb57fb5751502f72
SHA1 27bf8ee265ec23ce294811fee8237cf59a0b5726
SHA512 bbf716bbe731c658ba81c3723108c47dc7985adb3b0a55ed042c75ac3218551c1191db022b849367ad20238a748e967d7ac3f5cbf7f7200484439144fd2a61b7
SSDEEP 192:sxRCR+yM/jK1Ml8wCZ/fZstBlvZZxZ1zoA8pi/g6+WNIYD9a6SgGmVIgtJ:sxRCI8Z/fZsflxzZYi/5I2Ss3
TLSH
T1A252EA166A245D779CDBD209FA557F93D6F81573A2901E44EAFCDA0C00E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 289eb341720d6a6e09b3b9ba318892e81e5ecc65367726e1f6b330f08eeb3e9d
MD5 5698b070784d286f5657c408db88a11a
SHA1 7aa4852ce1aef244908ca4ef6b3fd288390e2bd9
SHA512 71349c198fc22189b085bdbf2657b4da4067992144a4eaed36546330dbe2f444b76dbce858acefe9752b50420307c3ed44efb7a3c7926d7a6367740bce64c693
SSDEEP 192:sxRBR+yM/jK1Ml8wCZ/fZsvBlvZZxZ1zoA8pi/g6+WNIYD9a6SgGmVIgDTJ:sxRBI8Z/fZsJlxzZYi/5I2Ssh
TLSH
T1BC52FA166A245D779CDBD209FA457F93D6F81573A2901E48EAFC9A0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 53b0b686e1d3db5003cf309ba6688903bbd3af7533ac4d215b8b7891d3f98924
MD5 e72d63b9a581207a889032fa40ddaa05
SHA1 6c8b98cdae7300d6d6a00c48d14558a9394d3cd2
SHA512 041d9178663d758a461dc1b24f7112893ac9252eb7f3a3a0ec95ac9fcb3e3c02eb4fb9a98d3f50e1c2c1f233d051399dd5c6b78db4446bf44fe07e57ed69f8fe
SSDEEP 192:sxRBR+yM/jK1Ml8UQ4CZ/fZsvB0vZZxZ5zoA8prS/g6+WNCmd/YD9+6SgGmVIgDD:sxRBIq/Z/fZsJ0xzZEO/5F/8Ssv
TLSH
T1B462EA1666245D779CDBD209FA55BF93D2F81573A2901E08EAFCDA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 746d61ccd929bc6b290bca03578ca30125a3c72c4346338cbe26e6e419585718
MD5 f2a174d88e64b34c6870694f1dd58480
SHA1 2b3b3613c29fd42dd352d93cbc524c0d9a8eb4bf
SHA512 d0ea6fa8bc6f8ec167f8aef88fbec4915ee8a2a1fcd621a662870d3058549d963226973e35092dab258eae700088aaaefa20cefa8467ecfa141506e0bb16229f
SSDEEP 192:sxRBR+yM/jK1Ml8wCZ/fZsvB0vZZxZ5zoA8p9S/g6+WNCmd/YD9+6SgGmVIgDZJ:sxRBI8Z/fZsJ0xzZEw/5F/8Ssv
TLSH
T15A62EA166A245D779CDBD209FA557F93D2F81573A2901E08EAFCDA0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 598e7ee8af811a01d825c100a15e049cb9f12c8defc24359787f2043ad7858d2
MD5 53cf16b91db5ee46a38704614a0792e3
SHA1 3678c181d365b6ce38e93b63ade6a33563581f98
SHA512 40e69316db806f9972a64d9a968196a9d8640886751bb342abc4232e6496e94ab174b5ae48e954709a47e1e1a2943e7e09dc116aec2943e01b53f6a3308befe8
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVCHc1sbro/lGcB:aW5WFdE710Wg/XfCfu1jaOCHyso/ln
TLSH
T140E2EB3B280CCB7E4F444A9CED297D9BADA801CF969CCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 74909772635c33025487b33648a1ee76c4e2d06a82f47c50c6b64b85ccd85ac6
MD5 a46de736b87ef8b34b8725e3d28c878b
SHA1 6c7e206a2cc8b64306a458396de275b2ed64a94c
SHA512 6ee6c1f2a68f958ee9dbcbbd515abd707942323af02434c27f7ee12f08546f679e2d75889d50e4a9601d0f04999831ca81e4806bd72763e7543f69e6b9e419e2
SSDEEP 96:KRLURlTp5FWtC4gNFK40gjFcrzKtZ+H8B8+8P8r8Z878/8LW8P8M86g8T8LK48yQ:CLURlTp5wtCZNv0gjarzKtZ+HYp8IamB
TLSH
T10B910E11313B4680797E6A198165C92ED2C274B2705DE92F3BEC45A70B66F07ADFC8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdbb0992-d721-4de1-af5c-592a95024a3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdbb0992-d721-4de1-af5c-592a95024a3e.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a45b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a45b5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 94bac3a08cd34364e7097f96cd23f0b81c11779a0df083b62fde0daa0ff9bcd2
MD5 9842be6de36a8e083b7d5b4220275afb
SHA1 c4171e2c6e22896ad0b1ddef0e7ebf001b42f9af
SHA512 b4a72c1258ef665dce20790f8e1c776e147a15a51ea096979cc83d5f6bab61837f19e57f7e8e2e2baf56b8fd3e1973c27d94d219ed8b0a39174baa0145d25625
SSDEEP 768:rrv+4UNbdS3xmi0TrEnjN3Gac1Z0eVH1SCz:rbsbg32TQnjMaTEH1V
TLSH
T1A603BF3669B88AB38CE7A38571877A037FF4525386940BE4C9CD6B0D069B5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7f4091480c21e16a44237e9d2350edc5e0922ea9ca7bec2d0178aa0049836a32
MD5 952f1a0082ab1b415a48b4148544679e
SHA1 f3c36be300625855d96a27140c9852845c9abdee
SHA512 55b7fe64b1e09bc1bb4bd77c0d60807298043f496eafdb59286f1ef2d56958f232ab92ab969df7cd147b3325dec3772b4aeb4c782b401b413513854b4eff4498
SSDEEP 384:nytNn/s3n9S338Nx3rXUvJJuWZlf8hyEGUi7FrAdy2rEoajo4cdR8eHhVODjYPNI:yj+9I3jti0wrEnjN3Gac1Fob9Mg
TLSH
T1AFF2BF3469A58EB38CD6D38572873B83BFE016B385D50E58DAC9AB0D09C36EC5707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 54917055d5bfb985d2cc6ed41534bb9362e68f3f2fa1a0ba3c72ec72385f7f65
MD5 c3f1abbbb10832667e4483db8f0dd258
SHA1 735a62981e1819075da09c98b05cd20b2f917a15
SHA512 68f407a4e008cb0b133b18fa5405facad46c732d3a4abc77b293a14f874f17422ee8e5e8725b56f65859381c1e835407cd6bcdaca802318bae85e520ef45c00d
SSDEEP 384:nsiF1tNn/s3n9SP38ND8TUNTUlIlGrXUvNJu4Hfc5yEGUi7FrASy2rEoajo4cdRI:XF1j+903MwgROsXrEnjN3Gac1Fob9Mg
TLSH
T1541306F598D78A77D89E8787677E2E429ABCC2A3B5844994BBC45D0CCC831BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d35f8ce0b1fa2234e96e91a3ea5df0147aedeb348ddf9c748bbb58470b968296
MD5 169c181460c5eae6d3399033cc4ee429
SHA1 dad4a297cb13980198eaf3b8e6e126af8f978e41
SHA512 239e12be604ffca456b35407d50372caf0c025d3297d58aacbc05fd16371dae5d10611cf950eda2c7c50225d80d4d06037185a56495ea6eb2bb8f264078ce74a
SSDEEP 384:n+srv+89zHqlDNP9oidW38Nx3rXUVJJuWZlf8hyEGUi7FrAdy2rEoajo4cdR8eHo:prv+4UNbdW3dti0wrEnjN3Gac1Fob9Mo
TLSH
T1F213B0357968CEB38CE7D255B18776537FF016A385D50B98DAC9AB0C0A874EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

37b2c476-4166-4a8b-9a48-ccc92027e190.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\37b2c476-4166-4a8b-9a48-ccc92027e190.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3024_1377939263\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f198f78efcb07d3910811ec2638d47332ed89a48a3e07cc3a3a9aba8edfd6621
MD5 dc50a6cfca03b23a11bc95aa86a4b821
SHA1 a3d8b8d86d059381597e71373cf5785e5f9e0651
SHA512 541770975e546e2d912bf1d0bc2266aaa4046552eb24b0dce3fedb234bf954b65b510b966233b8e59da8326e72e33fbac5ea5beb0a6235672bf520c56f7fee93
TLSH
T1B871238396B9C6B3C2DE5FF502835648F5FB2238072330740B615586BB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/928-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/928-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1132-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1296-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1296-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1296-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1536-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1608-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2416-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2588-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2628-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2640-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2640-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3824-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4260-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4312-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4868-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download